PolarEdge C2 Communication via Custom Binary Protocol with Custom TLS Server

In early 2025, security researchers identified a sophisticated botnet implant named PolarEdge. This implant utilizes a custom TLS server and a proprietary binary protocol for unauthenticated command-and-control operations.

PolarEdge was first detected in January 2025, when monitoring systems observed suspicious traffic exploiting the vulnerability CVE-2023-20118 in Cisco routers. The attackers employed a crafted HTTP request with a User-Agent header to achieve remote code execution, download an FTP shell script named "q," and deploy an undocumented implant.

The primary sample under analysis targets QNAP NAS devices, identified by the SHA-256 hash a3e2826090f009691442ff1585d07118c73c95e40088c47f0a16c8a59c9d9082. This 1.6 MB ELF64 binary is stripped and statically linked but not obfuscated, though it incorporates multiple anti-analysis techniques.

When executed without arguments, the implant operates in server mode, initiating an mbedTLS-based TLS server on port 49254. It sends a daily host fingerprint to its command-and-control (C2) server and waits for incoming commands via a custom binary protocol. At startup, the backdoor manipulates utilities like wget and curl and renames QNAP-CMS-WS CGI scripts, likely to prevent access by competing threat actors.

Configuration data is located in the last 512 bytes of the binary and split into three XOR-encrypted segments, which include a "Filter-file" path marker, TLS server parameters with the custom protocol token "fWbmufIFB," and the C2 server list.

The implant validates incoming request packets by verifying several hardcoded magic tokens and the stored protocol token. It executes commands if the HasCommand flag equals ASCII 1, returning raw command output without additional framing or authentication.

Custom Protocol, Encryption, and Anti-Analysis

PolarEdge's custom binary protocol uses seven tokens embedded in the .rodata section. A valid request starts with fixed magic values, followed by the token matching "WbmufIFB," a two-byte command length, and the command string itself. This design allows an unauthenticated attacker with the implant binary to execute arbitrary shell commands on compromised devices.

To protect its configuration and code sections, the backdoor uses a one-byte XOR key (0x11) and two rotation ciphers for section names. It employs the lightweight PRESENT block cipher in a chained mode for runtime decryption of the .init_rodata and .init_text segments, restoring TLS certificates, magic values, and core routines.

During operation, a dedicated thread constructs an encrypted HTTP GET request containing device details, such as public IPs, MAC addresses, process ID, module version, and filter file path, to the C2. If the server responds with a payload, it is saved as /tmp/.qnax.sh and executed. The backdoor disguises itself as legitimate processes, attempts to remount its own /proc/<pid> directory, and uses a watchdog process to relaunch the implant if its parent directory is removed.

Beyond server mode, PolarEdge supports a connect-back mode, acting as a TLS client to download files specified by command-line parameters, and a debug mode that updates the C2 list on-the-fly when supplied with the encrypted address and the presence of the filter file. These functions allowed researchers to redirect communications to controlled servers for analysis.

The in-depth reverse-engineering of PolarEdge reveals a highly modular and evasive backdoor built around a custom TLS server and unauthenticated binary protocol. Its encryption techniques protect configuration and code, while anti-analysis measures and flexible modes of operation highlight its sophistication.

Based on reporting by GBHackers.